registry  /  kritzel-stencil  /  0.3.33

kritzel-stencil@0.3.33

Kritzel helps you build infinite whiteboard experiences.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a Stencil whiteboard component library with optional collaboration and asset-upload providers controlled by host application configuration.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
Importing the library or using its web components; network behavior only when host code configures sync/asset providers.
Impact
No unauthorized execution, exfiltration, persistence, or destructive behavior identified.
Mechanism
Benign UI/collaboration library behavior
Rationale
Static inspection shows package-aligned Stencil component and collaboration/asset-storage functionality, with network calls dependent on consumer-provided configuration. Scanner findings appear to be noisy matches on Stencil lazy loading, ProseMirror Unicode documentation/comments, licensing text, and legitimate sync providers.
Evidence
package.jsondist/index.cjs.jsdist/index.jsloader/index.jsloader/index.cjs.jsdist/collection/classes/providers/assets/http-asset-provider.class.jsdist/collection/classes/providers/assets/presigned-asset-provider.class.jsdist/collection/classes/providers/sync/websocket-sync-provider.class.jsdist/collection/classes/managers/license.manager.jsdist/cjs/index-Xav9JFHg.jsdist/esm/schema.constants-3oYjlURq.jsdist/cjs/schema.constants-BHr5Bcqs.js
Network endpoints2
ws://localhost:1234kritzel.io/

Decision evidence

public snapshot
AI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for block
  • Runtime includes user-invoked sync/asset network helpers in dist/collection/classes/providers/*.
  • Stencil runtime uses bounded lazy dynamic require/import for component entry chunks.
Evidence against
  • package.json has no install/preinstall/postinstall/prepare lifecycle hooks.
  • Entrypoints dist/index.cjs.js and dist/index.js only re-export bundled library code.
  • Network calls use caller-supplied URLs/headers for collaboration or asset storage; no hardcoded exfiltration endpoint found.
  • License manager validates an offline Ed25519 token via WebCrypto and does not contact a server.
  • Trojan-source scan found no bidi/invisible control characters in flagged schema.constants files.
  • No child_process, shell execution, credential harvesting, destructive filesystem writes, or AI-agent control-surface writes found.
Behavioral surface
Source
ChildProcessDynamicRequireNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
ManifestNo manifest risk signals triggered.
scanned 325 file(s), 9.14 MB of source, external domains: bugs.chromium.org, bugs.webkit.org, cdn.jsdelivr.net, chat.stenciljs.com, code.haverbeke.berlin, commonmark.org, developer.microsoft.com, developer.mozilla.org, ecma-international.org, eev.ee, en.wikipedia.org, github.com, golang.org, kritzel.io, mathiasbynens.be, npms.io, prosemirror.net, stackoverflow.com, stenciljs.com, w3c.github.io, www.awsarchitectureblog.com, www.stum.de, www.w3.org

Source & flagged code

3 flagged · loading source
dist/index.cjs.jsView file
1module.exports = require('./cjs/index.cjs.js');
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjs.jsView on unpkg · L1
dist/esm/schema.constants-3oYjlURq.jsView file
2602contains invisible/control Unicode U+200B (zero width space) Get the _n_<U+200B>th outgoing edge from this node in the finite
Critical
Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/esm/schema.constants-3oYjlURq.jsView on unpkg · L2602
dist/cjs/schema.constants-BHr5Bcqs.jsView file
•Trigger-reachable chain: manifest.main -> dist/index.cjs.js -> dist/cjs/index.cjs.js -> dist/cjs/schema.constants-BHr5Bcqs.js Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cjs/schema.constants-BHr5Bcqs.jsView on unpkg

Findings

2 Critical4 Medium4 Low
CriticalTrojan Source Unicodedist/esm/schema.constants-3oYjlURq.js
CriticalTrigger Reachable Dangerous Capabilitydist/cjs/schema.constants-BHr5Bcqs.js
MediumDynamic Requiredist/index.cjs.js
MediumNetwork
MediumProtestware
MediumStructural Risk Force Deep Review
LowScripts Present
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings